CVE-2026-84289: Uncontrolled Memory Allocation in NousResearch hermes-agent

This vulnerability in NousResearch hermes-agent (versions 0.18.0, 0.18.1, and 0.18.2) involves uncontrolled memory allocation triggered by manipulating the list_tools function in tools/mcp_tool.py of the MCP Tool component. The flaw allows remote attackers to initiate the attack without requiring user interaction or elevated privileges. Although an exploit has been publicly disclosed, the vendor has not issued any advisory or patch, and no official remediation is currently known.

Successful exploitation can lead to uncontrolled memory allocation, potentially causing denial of service or resource exhaustion on affected systems. The vulnerability is remotely exploitable without authentication or user interaction, increasing the risk of attack. However, no evidence of active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. In the meantime, consider restricting network access to the affected service or applying other environment-specific controls to limit exposure.